Documentation
¶
Index ¶
- func ExtractPackageName(path string) string
- func IsYarnBerry(data []byte) bool
- func ParseIntegrity(integrity string) (algorithm string, hash []byte, err error)
- type BerryPackage
- type Decomposer
- type DependencyTree
- type DependencyType
- type LockPackage
- type Options
- type PackageJSON
- type PackageKey
- type PackageLock
- type PnpmImporter
- type PnpmLock
- type PnpmPackage
- type Repository
- type YarnBerryLock
- type YarnLock
- type YarnPackage
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExtractPackageName ¶
ExtractPackageName extracts the package name from a node_modules path. e.g., "node_modules/@scope/package" -> "@scope/package" e.g., "node_modules/package" -> "package" e.g., "node_modules/a/node_modules/b" -> "b"
func IsYarnBerry ¶ added in v0.3.2
IsYarnBerry says whether lock data is the berry format rather than the classic one.
Types ¶
type BerryPackage ¶ added in v0.3.2
type BerryPackage struct {
Name string
Version string
// WorkspacePath is the directory of a workspace entry, empty for a
// fetched package.
WorkspacePath string
// Dependencies maps names to the protocol-carrying references the
// entry requires.
Dependencies map[string]string
}
BerryPackage is one resolved entry.
type Decomposer ¶
type Decomposer struct{}
func New ¶
func New() *Decomposer
func (*Decomposer) DefaultOptions ¶
func (d *Decomposer) DefaultOptions() any
DefaultOptions returns the default options for the npm decomposer.
func (*Decomposer) Extract ¶
func (d *Decomposer) Extract(opts *api.DecomposerOptions) (*sbom.NodeList, error)
Extract parses package.json and package-lock.json files and builds the complete dependency graph as a protobom NodeList.
func (*Decomposer) FindCodeBases ¶
func (d *Decomposer) FindCodeBases(index *code.PathIndex) ([]string, error)
FindCodeBases locates JavaScript codebases by their lockfiles. Lockfiles vendored under node_modules belong to installed dependencies, not to the codebase, and are skipped.
func (*Decomposer) Requirements ¶
func (d *Decomposer) Requirements(_ *api.DecomposerOptions) []api.Requirement
Requirements returns the requirements for the decomposer. No external binary required - uses pure Go implementation.
type DependencyTree ¶
type DependencyTree struct {
// contains filtered or unexported fields
}
DependencyTree builds a complete dependency graph from npm package files.
func NewDependencyTree ¶
func NewDependencyTree(pkg *PackageJSON, lock *PackageLock) *DependencyTree
NewDependencyTree creates a new dependency tree from parsed npm package files.
func (*DependencyTree) Build ¶
func (dt *DependencyTree) Build(opts *api.DecomposerOptions) (*sbom.NodeList, error)
Build constructs the complete dependency graph as a protobom NodeList.
func (*DependencyTree) GetDependencyCount ¶
func (dt *DependencyTree) GetDependencyCount() int
GetDependencyCount returns the total number of dependencies.
func (*DependencyTree) GetDirectDependencyCount ¶
func (dt *DependencyTree) GetDirectDependencyCount() int
GetDirectDependencyCount returns the number of direct dependencies.
func (*DependencyTree) ListDependencies ¶
func (dt *DependencyTree) ListDependencies() []string
ListDependencies returns a sorted list of all dependencies for debugging/testing.
type DependencyType ¶
type DependencyType int
DependencyType represents the type of dependency relationship.
const ( DepTypeNormal DependencyType = iota DepTypeDev DepTypePeer DepTypeOptional )
func (DependencyType) String ¶
func (dt DependencyType) String() string
String returns a string representation of the dependency type.
type LockPackage ¶
type LockPackage struct {
Name string `json:"name,omitempty"`
Version string `json:"version"`
Resolved string `json:"resolved,omitempty"`
Integrity string `json:"integrity,omitempty"`
License string `json:"license,omitempty"`
Dev bool `json:"dev,omitempty"`
Optional bool `json:"optional,omitempty"`
Peer bool `json:"peer,omitempty"`
DevOptional bool `json:"devOptional,omitempty"`
Dependencies map[string]string `json:"dependencies,omitempty"`
OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
// contains filtered or unexported fields
}
LockPackage represents a package entry in package-lock.json.
type Options ¶
type Options struct {
// IncludeDevDependencies includes dev dependencies in the output.
IncludeDevDependencies bool
// IncludeOptionalDependencies includes optional dependencies in the output.
IncludeOptionalDependencies bool
// IncludePeerDependencies includes peer dependencies in the output.
IncludePeerDependencies bool
// IgnoreNodeModulesCodebases instructs the decomposer to ignore any codebases
// in node_modules directories (package-lock files from pulled dependencies)
IgnoreNodeModulesCodebases bool
}
Options configures the npm dependency extraction.
type PackageJSON ¶
type PackageJSON struct {
Name string `json:"name"`
Version string `json:"version"`
Description string `json:"description,omitempty"`
License string `json:"license,omitempty"`
Homepage string `json:"homepage,omitempty"`
Repository *Repository `json:"repository,omitempty"`
Dependencies map[string]string `json:"dependencies,omitempty"`
DevDependencies map[string]string `json:"devDependencies,omitempty"`
PeerDependencies map[string]string `json:"peerDependencies,omitempty"`
OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
}
PackageJSON represents the structure of a package.json file.
func ParsePackageJSON ¶
func ParsePackageJSON(dir string) (*PackageJSON, error)
ParsePackageJSON parses a package.json file from the given directory.
func ParsePackageJSONData ¶
func ParsePackageJSONData(data []byte) (*PackageJSON, error)
ParsePackageJSONData parses package.json content from bytes.
func (*PackageJSON) GetAllDependencyNames ¶
func (pj *PackageJSON) GetAllDependencyNames() []string
GetAllDependencyNames returns all direct dependency names.
func (*PackageJSON) GetDirectDependencies ¶
func (pj *PackageJSON) GetDirectDependencies() map[string]DependencyType
GetDirectDependencies returns a map of dependency names to their types.
type PackageKey ¶
PackageKey uniquely identifies a package by name and version.
func (PackageKey) String ¶
func (pk PackageKey) String() string
type PackageLock ¶
type PackageLock struct {
Name string `json:"name"`
Version string `json:"version"`
LockfileVersion int `json:"lockfileVersion"`
Requires bool `json:"requires"`
Packages map[string]LockPackage `json:"packages"`
}
PackageLock represents the structure of a package-lock.json file (v3 format).
func ParsePackageLock ¶
func ParsePackageLock(dir string) (*PackageLock, error)
ParsePackageLock parses a package-lock.json file from the given directory.
func ParsePackageLockData ¶
func ParsePackageLockData(data []byte) (*PackageLock, error)
ParsePackageLockData parses package-lock.json content from bytes.
func (*PackageLock) BuildPackageIndex ¶
func (pl *PackageLock) BuildPackageIndex() (byKey map[PackageKey]*LockPackage, byName map[string][]*LockPackage, byPath map[string]*LockPackage)
BuildPackageIndex creates indexes for quick package lookups.
func (*PackageLock) GetRootPackage ¶
func (pl *PackageLock) GetRootPackage() *LockPackage
GetRootPackage returns the root package (the one at key "").
type PnpmImporter ¶ added in v0.3.2
type PnpmImporter struct {
Dependencies map[string]string
DevDependencies map[string]string
OptionalDependencies map[string]string
}
PnpmImporter is one of the project's own packages, with its direct dependencies by kind. Values are version references: a resolved version, or link:<path> pointing at another importer.
type PnpmLock ¶ added in v0.3.2
type PnpmLock struct {
// LockfileVersion is the schema version the file declared.
LockfileVersion string
// Importers are the project's own packages: "." for the project
// itself, one more per workspace member, keyed by their directory.
Importers map[string]*PnpmImporter
// Packages are the resolved third-party packages, keyed name@version.
Packages map[string]*PnpmPackage
}
PnpmLock is a parsed pnpm-lock.yaml, normalized.
func ParsePnpmLock ¶ added in v0.3.2
ParsePnpmLock reads a pnpm-lock.yaml document.
func ReadPnpmLock ¶ added in v0.3.2
ReadPnpmLock reads a pnpm-lock.yaml from a directory.
type PnpmPackage ¶ added in v0.3.2
type PnpmPackage struct {
Name string
Version string
Integrity string
Tarball string
// Dependencies and OptionalDependencies are the package's edges,
// name to resolved version.
Dependencies map[string]string
OptionalDependencies map[string]string
}
PnpmPackage is one resolved package.
type Repository ¶
Repository represents the repository field in package.json.
func (*Repository) UnmarshalJSON ¶
func (r *Repository) UnmarshalJSON(data []byte) error
UnmarshalJSON handles both string and object forms of repository.
type YarnBerryLock ¶ added in v0.3.2
type YarnBerryLock struct {
// Entries maps every selector to its resolution, edges resolving by
// exact lookup as in the classic format.
Entries map[string]*BerryPackage
// Workspaces are the project's own packages, keyed by their directory.
Workspaces map[string]*BerryPackage
}
YarnBerryLock is a parsed berry yarn.lock.
func ParseYarnBerryLock ¶ added in v0.3.2
func ParseYarnBerryLock(data []byte) (*YarnBerryLock, error)
ParseYarnBerryLock reads a berry yarn.lock document.
type YarnLock ¶ added in v0.3.2
type YarnLock struct {
// Entries maps every selector — "name@range", one block may serve
// several — to its resolution. Edges resolve through this map: a
// dependency states a name and a range, and the pair is a selector.
Entries map[string]*YarnPackage
}
YarnLock is a parsed classic yarn.lock.
func ParseYarnLock ¶ added in v0.3.2
ParseYarnLock reads a classic yarn.lock document.
func ReadYarnLock ¶ added in v0.3.2
ReadYarnLock reads a yarn.lock from a directory.
func (*YarnLock) Resolve ¶ added in v0.3.2
func (l *YarnLock) Resolve(name, rang string) *YarnPackage
Resolve finds the package a name and range pair selects.
type YarnPackage ¶ added in v0.3.2
type YarnPackage struct {
Name string
Version string
Resolved string
Integrity string
// Dependencies and OptionalDependencies map names to the ranges the
// package requires, resolvable through the lock's selectors.
Dependencies map[string]string
OptionalDependencies map[string]string
}
YarnPackage is one resolved package.